Chart Overlay Help

[b17gunnr]

Hello folks,

I'm struggling with something that should be very basic. I have two queries to track skipped scheduled searches, the first counts the number of times a search has been skipped and the second counts how many times my individual SHC members have skipped a search. What I would like to be able to do is render my first query as a column chart and then overlay the second as a line chart. Any help would be appreciated. Thank you.

index=_internal sourcetype=scheduler status="skipped" | timechart count BY savedsearch_name useother=f usenull=f limit=0

index=_internal sourcetype=scheduler status="skipped" | timechart count BY host useother=f usenull=f limit=0

[PrewinThomas · Accepted solution]

@b17gunnr 

Try appendcols to merge the results of the two timechart searches.

This should give you savedsearch_name series and all the host series side by side.

index=_internal sourcetype=scheduler status="skipped"
| timechart count BY savedsearch_name useother=f usenull=f limit=0
| appendcols [
search index=_internal sourcetype=scheduler status="skipped"
| timechart count BY host useother=f usenull=f limit=0
]

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[PickleRick]

Wow. This is one of the very few cases where appendcols actually makes sense since due to timechart usage and aligned time ranges you should get matching results in both searches. 👍

[sainag_splunk]

@b17gunnr Hi!! based on what I can think of this might help?

  index=_internal sourcetype=scheduler status="skipped"

  | timechart count BY savedsearch_name limit=5

  | addtotals col=t labelfield=_time label="Total_Hosts"

  Then in Visualization:

  1. Chart Type: Column Chart

  2. Format → Chart Overlay → On

  3. Overlay field: Select Total_Hosts (or whatever the total field is named)

  4. Chart Overlay type: Linear

  This gives you:

  - Column chart: Individual savedsearch skip counts

  - Line overlay: Total volume trend across all hosts